Florida’s Department of Highway Safety and Motor Vehicles confirmed on September 11, 2026, that it was hacked by what the agency called “an international cybercriminal organization,” disclosing a second, previously unreported intrusion just days after a separate breach exposed driver credentials tied to a Plant City Police Department officer. The admission, first reported by NBC News, makes FLHSMV the second organization holding Americans’ driver’s license data to be hacked within the same month, following the disclosure that identity-verification vendor IDScan.net had been breached, exposing more than 153 million license scans through a dark-web marketplace called Nexus.
The timing has turned September 2026 into one of the worst stretches on record for driver’s license data in the United States. Within roughly ten days, three distinct incidents surfaced involving driver credentials: the IDScan.net breach tied to the Nexus marketplace, a credential-theft breach of Florida’s DAVID law enforcement database, and now a separate hack of FLHSMV’s own systems that the agency says it detected on September 4 and has since contained. Each incident has a different cause, a different scope, and a different actor, but together they illustrate how fragile the pipeline of government-issued identity data has become.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What FLHSMV Actually Confirmed on September 11
In a statement posted to its official channels, FLHSMV said, “On September 4, 2026, FLHSMV learned of a data breach conducted by an international cybercriminal organization.” The agency added a line meant to reassure Floridians: “The data breach was quickly mitigated and no further breach has occurred or is ongoing,” according to the agency’s public statement. NBC News, which broke the story, reported that “the department said in a statement published to its website that the breach was conducted by an international cybercriminal organization,” and framed the incident squarely in context: FLHSMV becoming “the second organization that hosts Americans’ driver’s license information to be hacked this month,” per NBC News.
FLHSMV has not named the group responsible, has not disclosed how many records were affected, and has not detailed the attack vector. That is a meaningfully different disclosure posture than the agency took with the separate DAVID database breach, where it pointed to a specific, identifiable cause: credentials belonging to a Plant City Police Department employee that had been improperly stored on a personal device. The vaguer “international cybercriminal organization” language leaves open the possibility that this incident involved a more sophisticated, financially motivated group operating outside U.S. jurisdiction, though the agency has offered no further attribution details.
Timeline: How September Became Florida’s Worst Month for Driver Data
Piecing together reporting from multiple outlets shows a compressed, overlapping sequence of events rather than a single incident. Identity-verification company IDScan.net told customers “on or around September 1, 2026” that it had detected unauthorized access to its cloud environment, according to KrebsOnSecurity. That breach fed a dark-web listing on a service called Nexus, which was found to be selling more than 153 million driver’s license scans along with over 10 million identification cards and roughly 3 million travel documents, per reporting from SecurityWeek.
Days later, the extortion group ShinyHunters claimed on its leak site to have separately breached Florida’s DAVID driver and vehicle database, threatening to publish more than 200,000 records unless the state negotiated by September 11, as tech-insider.org detailed at the time, and according to CSO Online. FLHSMV subsequently confirmed that breach was tied to login credentials belonging to a single Plant City Police Department employee, stored improperly on a personal device, as tech-insider.org previously reported. ShinyHunters also posted material referencing a high-profile record among the stolen files, a development covered separately by tech-insider.org. That same week, IDScan.net formally confirmed its own breach, a story tech-insider.org tracked through its initial disclosure and the subsequent FBI probe, as detailed by BleepingComputer on September 10. By September 12, 2026, Tech Insider reported that FLHSMV still had not confirmed the exact number of records accessed in the DAVID breach, leaving ShinyHunters’ 200,000-record claim formally unverified even as the negotiation deadline passed.
| Date (2026) | Event | Source |
|---|---|---|
| Sept. 1 | IDScan.net detects unauthorized cloud access | KrebsOnSecurity |
| Sept. 4 | FLHSMV says it learned of a separate hack by an “international cybercriminal organization” | FLHSMV statement |
| Sept. 6 | USA Today reports FBI probing the Nexus/IDScan.net breach | USA Today |
| Sept. 9 | ShinyHunters claims DAVID database breach, sets negotiation deadline | CSO Online |
| Sept. 10 | IDScan.net formally confirms breach tied to 153M license scans | BleepingComputer |
| Sept. 11 | FLHSMV confirms DAVID breach via officer’s stored credentials; separately confirms the September 4 hack publicly | NBC News, FLHSMV |
Three Separate Incidents, Not One Mega-Breach
It’s easy to conflate these stories into a single narrative, but the three incidents involve different systems, different attackers, and different mechanisms. Understanding the distinctions matters both for affected individuals deciding whether to freeze credit and for security teams drawing lessons from the month.
The Officer-Credential DAVID Breach
This incident involved a single compromised credential belonging to a Plant City Police Department employee, improperly stored on a personal electronic device. That credential gave an outside party direct access to Florida’s DAVID system, a law-enforcement-restricted database, resulting in the theft of more than 200,000 driver records; CBS12 reported in September 2026 that the compromised account had reached just one system, DAVID, which stores driver and vehicle records. ShinyHunters claimed responsibility and used the stolen data as extortion leverage.
The FLHSMV “International Cybercriminal Organization” Hack
This is the newly confirmed, separate incident: FLHSMV says it discovered the intrusion on September 4, describes the attacker only as an “international cybercriminal organization,” and says the breach has been contained with no further access ongoing. No record count, attack vector, or group name has been disclosed as of this writing.
The IDScan.net / Nexus Breach
This is the largest by volume but has no confirmed connection to Florida DMV systems at all. IDScan.net, a Louisiana-based identity-verification company whose technology is used across banking, car rentals, and other sectors, had customer data including full names and government ID numbers exposed and later listed for sale on the Nexus dark-web marketplace, affecting more than 153 million license scans, according to KrebsOnSecurity and SecurityWeek reporting.
| Incident | Systems Affected | Records | Cause | Status |
|---|---|---|---|---|
| DAVID database (officer credential) | Florida DAVID law enforcement database | 200,000+ | Officer credentials stored on personal device | Confirmed by FLHSMV |
| FLHSMV “international” hack | FLHSMV internal systems | Not disclosed | Attributed to “international cybercriminal organization” | Contained, per FLHSMV |
| IDScan.net / Nexus | IDScan.net cloud environment | 153,000,000+ scans | Unauthorized third-party access to vendor cloud | Confirmed by IDScan.net, FBI investigating |
Who Is Behind the Attack? What’s Known and What Isn’t
FLHSMV’s decision to describe its attacker only as an “international cybercriminal organization” is notable for what it withholds. The agency has not linked the incident to ShinyHunters, the group that separately claimed responsibility for the DAVID credential breach, nor to any group associated with the IDScan.net/Nexus data. That ambiguity is common in early-stage breach disclosures, where agencies deliberately avoid naming a specific actor until an investigation, often involving federal law enforcement, is further along.
What is clear is that the broader driver’s license data ecosystem became a magnet for multiple, unrelated threat actors in the same narrow window. The FBI is already investigating the Nexus/IDScan.net breach, according to USA Today, and it would not be surprising if federal investigators end up examining the FLHSMV incident as well, given the overlapping timing and shared target category. As of this writing, no arrests, indictments, or formal attributions have been publicly announced in connection with the FLHSMV hack specifically.
Why State DMV Databases Have Become a Top Target
State motor vehicle agencies sit at an unusually attractive intersection for attackers: they hold verified, government-issued identity data at massive scale, they interoperate with law enforcement systems like DAVID that carry elevated trust, and they often rely on third-party vendors, such as identity-verification firms, that extend the attack surface well beyond the agency’s own network perimeter. A single compromised credential, as in the Plant City officer case, or a single compromised vendor, as in the IDScan.net case, can expose records that took decades of citizen interactions to accumulate.
The three September incidents also expose a structural weakness that security teams have flagged for years: driver’s license data is simultaneously decentralized (spread across state DMVs, law enforcement databases, and private verification vendors) and highly reusable by attackers, since a license number and photo can be repurposed for account takeover, synthetic identity fraud, or bypassing know-your-customer checks at banks and crypto exchanges. That reusability is precisely why a marketplace like Nexus could aggregate scans from an identity-verification vendor rather than a government agency and still find eager buyers.
Market and Industry Impact
The immediate commercial fallout has concentrated on IDScan.net and its enterprise clients, several of which reportedly rely on the company’s scanning technology for age verification and fraud checks in banking and car rentals. Multiple lawsuits have already been filed over the IDScan.net breach, and the FBI’s involvement raises the likelihood of regulatory scrutiny extending to the vendor’s enterprise customers who trusted it with scanned identity documents.
For FLHSMV, the reputational cost of a second confirmed hack in the same window is harder to quantify but arguably more damaging, since it undercuts public confidence in a state agency’s ability to safeguard data it is legally required to protect. Identity-verification and KYC vendors more broadly are likely to face renewed pressure from enterprise clients to prove cloud environments are segmented and monitored, particularly after the same month produced two separate confirmed breaches touching driver’s license data through entirely different vectors.
Historical Context: A Pattern of Government Identity Data Exposure
Breaches touching driver’s license and state ID data are not new, but the scale and frequency have escalated. Government identity databases have increasingly become targets precisely because they combine high-value data with legacy infrastructure and, in many cases, third-party integrations that were not designed with modern threat models in mind. The pattern seen in Florida this month, one credential-based breach, one vendor-side breach, and one attributed to an unnamed international group, mirrors a broader trend security researchers have tracked across 2026: attackers increasingly target the weakest link in an identity-verification chain rather than attempting to breach a well-defended primary system directly.
What differs this time is the compression: three related-but-distinct incidents surfaced publicly within roughly a ten-day span, all touching the same category of data. That clustering, rather than any single incident’s scale, is what has made this month a reference point for identity-data risk discussions among security teams and state IT officials.
Competitive Comparison: How State DMV Security Postures Differ
Florida is far from the only state managing a sprawling driver database with law-enforcement integrations, and its DAVID system is a widely used model for interstate data-sharing among motor vehicle agencies. The core lesson from Florida’s month is less about the state’s specific defenses and more about a shared architectural risk: any state relying on personal-device access, third-party identity-verification vendors, or federated law-enforcement databases inherits the same exposure surface. Agencies that enforce hardware-backed multi-factor authentication and restrict credential use to managed devices reduce the risk of the exact failure mode seen in the Plant City case, while agencies that outsource scanning or verification to third parties inherit that vendor’s security posture, as IDScan.net’s enterprise clients discovered this month.
The comparison also underscores a widening gap between agencies that have modernized identity and access management and those still relying on legacy credential-sharing practices between local law enforcement and state systems. FLHSMV’s DAVID database, by design, grants credentialed access to thousands of law enforcement personnel across the state, a scale that makes credential hygiene at the individual officer level a systemic risk rather than a one-off failure.
What Floridians Should Do Right Now
Because FLHSMV has not disclosed which records were affected in the September 4 hack, Floridians have no way to confirm individually whether their data was included. Security guidance following any of the three incidents converges on similar steps: place a credit freeze with the three major credit bureaus, enable identity-theft monitoring where available, watch for unexpected account-opening notifications, and be skeptical of unsolicited communications referencing driver’s license numbers, since stolen license data is frequently used to make phishing and social-engineering attempts appear more credible — guidance that carries extra weight given HackRead’s September 2026 report that the data allegedly stolen in the DAVID breach included Social Security numbers alongside driver’s license information.
For Floridians specifically affected by the DAVID database breach, official notification is expected to come through FLHSMV directly rather than through IDScan.net, since the two incidents involve entirely separate organizations and data sets. Anyone who receives a notification referencing either the IDScan.net breach or the FLHSMV hack should verify the notice against official agency communications before responding or clicking any embedded links.
Regulatory and Legal Fallout
The FBI’s involvement in the IDScan.net/Nexus breach, confirmed by USA Today, signals that federal authorities are treating the scale of that incident, more than 153 million records, as a matter warranting national investigation rather than a state-level consumer-protection issue alone. Multiple lawsuits have already been filed against IDScan.net in connection with that breach. Whether FLHSMV faces similar legal exposure over either the DAVID credential breach or the newly confirmed September 4 hack will likely depend on what the agency ultimately discloses about the scope of records affected, information it has not yet provided publicly.
State agencies generally face a different liability framework than private vendors like IDScan.net, often shielded by sovereign immunity provisions that limit consumer lawsuits, which means the more consequential accountability mechanism for FLHSMV may end up being legislative oversight and public records requests rather than civil litigation.
Predictions: What Happens Next
Based on the pattern established over the past two weeks, several developments look likely in the coming months:
- FLHSMV will likely face pressure from Florida lawmakers to disclose the scope of the September 4 breach, including a record count, given the vagueness of its initial statement.
- Federal investigators already probing the IDScan.net/Nexus breach may broaden their inquiry to examine whether any connection exists to the FLHSMV incident, given the overlapping timing and shared data category.
- Other state DMV agencies are likely to face renewed scrutiny over credential-management practices for law-enforcement personnel with database access, following the specific failure mode exposed in the Plant City case.
- Enterprise clients of identity-verification vendors will likely demand stronger contractual guarantees around cloud security and breach notification timelines following the IDScan.net incident.
- Expect additional lawsuits and possible congressional or state legislative attention on the broader question of how driver’s license data is shared across law enforcement, state agencies, and private verification vendors.
The Bigger Picture for Identity Data Security
Taken together, the three September incidents fit a wider pattern tech-insider.org has tracked across its cybersecurity coverage this year: driver’s license data has effectively become a commodity asset for cybercriminal groups, valuable enough to justify targeting government agencies, law-enforcement databases, and private verification vendors simultaneously rather than relying on a single point of compromise. FLHSMV’s own choice of words, an “international cybercriminal organization,” language distinct from ShinyHunters’ branded extortion campaign, suggests state officials are now dealing with more than one class of adversary at once: financially motivated extortion groups that publicize their attacks for leverage, and less visible actors who breach, exfiltrate, and disappear without a public claim.
For an agency the size of FLHSMV, which manages driver records for over 20 million licensed Florida drivers, even a well-contained breach carries lasting reputational weight. The agency’s insistence that “no further breach has occurred or is ongoing” will likely face continued scrutiny as more details emerge, particularly if federal investigators or independent researchers surface information the agency has not yet disclosed.
Frequently Asked Questions
Is the FLHSMV hack the same as the Plant City officer credential breach?
No. FLHSMV has described them as separate incidents. The officer-credential breach involved a Plant City Police Department employee’s login being improperly stored on a personal device and used to access the DAVID database, while the September 4 hack is attributed to an unnamed “international cybercriminal organization” with no disclosed connection to the officer’s credentials.
Is the FLHSMV hack connected to the IDScan.net/Nexus breach?
No confirmed connection has been reported. IDScan.net is a private, Louisiana-based identity-verification company, not a Florida state agency, and its breach involved a separate cloud environment used for enterprise identity-verification services.
How many records were exposed in the FLHSMV hack?
FLHSMV has not disclosed a record count for the September 4 incident as of this writing, and as of September 12, 2026, Tech Insider reported the agency had still not confirmed an exact figure for the separate DAVID database breach either, leaving ShinyHunters’ claim of more than 200,000 records formally unverified even as the agency acknowledged the underlying intrusion.
Has the FBI confirmed it is investigating the FLHSMV hack?
Reporting to date confirms FBI involvement in the IDScan.net/Nexus breach specifically. No outlet has confirmed a formal FBI investigation into the FLHSMV September 4 hack as a distinct matter.
What should Florida drivers do to protect themselves?
Security guidance following breaches of this type generally recommends placing a credit freeze with the major credit bureaus, monitoring for unexpected account activity, and treating any unsolicited communication referencing a driver’s license number with suspicion until verified through an official channel.
Who is the “international cybercriminal organization” FLHSMV referenced?
FLHSMV has not named the group. The agency’s public statement used only the general description, and no outlet has independently confirmed a specific group’s identity in connection with this particular incident.
Is this the largest driver’s license data breach of 2026?
No. The IDScan.net/Nexus breach, involving more than 153 million license scans, is substantially larger in scope than either Florida incident. The FLHSMV hack and the DAVID database breach are both smaller, state-specific incidents that happened to surface in the same news cycle.
Has FLHSMV said the breach is fully resolved?
The agency stated the breach “was quickly mitigated and no further breach has occurred or is ongoing,” but has not provided a full post-incident report detailing the scope of what was accessed.
